# Adapting packet filter in stand-alone cluster **URL:** \ **Category:** Zeek\ **Created:** [April 16, 2009, 10:01pm UTC](https://community.zeek.org/t/adapting-packet-filter-in-stand-alone-cluster/1503 "2009-04-16T22:01:31Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Tyler\_Schoenke](https://avatars.discourse-cdn.com/v4/letter/t/6de8d8/32.png) [@Tyler\_Schoenke](https://community.zeek.org/u/Tyler_Schoenke)\ **Post date:** [April 16, 2009, 10:01pm UTC](https://community.zeek.org/t/adapting-packet-filter-in-stand-alone-cluster/1503/1 "2009-04-16T22:01:31Z")
I am getting started with Bro, and am using Robin's 1.4 stand-alone cluster branch. I was trying to detect some IRC traffic using DPD, but realized that it was being filtered. In the Workshop 2009 materials, it mentioned adapting the packet filter by adding the -f "tcp". I tried that, tested it on my pcap file, and it worked. How do I enable/disable the -f "tcp" option in the cluster configuration? Tyler ---
**Author:** ![Seth\_Hall](https://avatars.discourse-cdn.com/v4/letter/s/50afbb/32.png) [@Seth\_Hall](https://community.zeek.org/u/Seth_Hall)\ **Post date:** [April 17, 2009, 2:39am UTC](https://community.zeek.org/t/adapting-packet-filter-in-stand-alone-cluster/1503/2 "2009-04-17T02:39:42Z")
You can do it from your policy script. In policy/local/local.bro (assuming you're using everything as it ships)... redef capture\_filters = { ["all-ip-packets"] = "ip or ip6" };    .Seth ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:38pm UTC](https://community.zeek.org/t/adapting-packet-filter-in-stand-alone-cluster/1503/3 "2022-05-06T15:38:53Z")